What causes "Invalid time-based one-time password (TOTP) was attempted for user: " in TechnitiumSoftware/DnsServer?

Have the user re-enter the code carefully from the authenticator app.

TechnitiumSoftware/DnsServer · error · Exception

Invalid time-based one-time password (TOTP) was attempted fo

Error message

Invalid time-based one-time password (TOTP) was attempted for user:

What it means

Thrown by User.EnableTOTP(totp) when Authenticator.IsTOTPValid(totp) returns false, i.e. the supplied 6-digit code does not match the TOTP value derived from _totpKeyUri within the current/adjacent time window. Unlike the other guards this is a plain Exception (not InvalidOperationException) because it represents bad user input rather than invalid state. No state is mutated on failure.

Source

Thrown at DnsServerCore/Auth/User.cs:308

            return _totpKeyUri;
        }

        public void EnableTOTP(string totp)
        {
            if (_isSsoUser)
                throw new InvalidOperationException("Time-based one-time password (TOTP) feature is not available for SSO users.");

            if (_totpKeyUri is null)
                throw new InvalidOperationException("Time-based one-time password (TOTP) was not initialized for user: " + _username);

            if (_totpEnabled)
                throw new InvalidOperationException("Time-based one-time password (TOTP) is already enabled for user: " + _username);

            Authenticator authenticator = new Authenticator(_totpKeyUri);

            if (!authenticator.IsTOTPValid(totp))
                throw new Exception("Invalid time-based one-time password (TOTP) was attempted for user: " + _username);

            _totpEnabled = true;
        }

        public void DisableTOTP()
        {
            if (_isSsoUser)
                throw new InvalidOperationException("Time-based one-time password (TOTP) feature is not available for SSO users.");

            if (!_totpEnabled)
                throw new InvalidOperationException("Time-based one-time password (TOTP) is already disabled for user: " + _username);

            _totpKeyUri = null;
            _totpEnabled = false;
        }

        public void LoggedInFrom(IPAddress remoteAddress)
        {

View on GitHub (pinned to d0484b6c1e)

Solutions

Have the user re-enter the code carefully from the authenticator app.
Ensure server time is correct (NTP) and within the RFC 6238 tolerance window.
Re-run InitializedTOTP to get a fresh QR and re-scan, confirming the app supports SHA-1/30s defaults.

Defensive patterns

Strategy: try-catch

Try / catch

try
{
    user.EnableTOTP(totpCode);
}
catch (Exception ex) when (ex.Message.Contains("Invalid time-based one-time password"))
{
    return BadRequest("The TOTP code was incorrect or expired. Please re-enter it from your authenticator app.");
}

Prevention

Keep server time synchronized via NTP to stay within the TOTP window.
Let the user re-enter the code on failure rather than locking them out immediately.
Verify the authenticator app uses the standard 30s/SHA-1 defaults matching the key URI.

When it happens

Trigger: The user mistyped the code, the authenticator app and server clocks have drifted beyond the accepted window, the wrong authenticator account was used, or the QR code was scanned by a different app that uses a different algorithm/period.

Common situations: Clock skew between the server and the device; the user scanned the QR for a different account; T0/period mismatch from a non-standard authenticator; copy-paste truncation of the code.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/14fbe0f8cad29304. Report an issue: GitHub.